diff --git a/runtime/bin/file_android.cc b/runtime/bin/file_android.cc
index 681c46f0e56..a3bb55845a4 100644
--- a/runtime/bin/file_android.cc
+++ b/runtime/bin/file_android.cc
@@ -421,7 +421,7 @@ bool File::Copy(Namespace* namespc,
   //   where sendfile() fails with EINVAL or ENOSYS.
   if ((result < 0) && ((errno == EINVAL) || (errno == ENOSYS))) {
     const intptr_t kBufferSize = 8 * KB;
-    uint8_t buffer[kBufferSize];
+    uint8_t* buffer = reinterpret_cast<uint8_t*>(malloc(kBufferSize));
     while ((result = TEMP_FAILURE_RETRY(read(old_fd, buffer, kBufferSize))) >
            0) {
       int wrote = TEMP_FAILURE_RETRY(write(new_fd, buffer, result));
@@ -430,6 +430,7 @@ bool File::Copy(Namespace* namespc,
         break;
       }
     }
+    free(buffer);
   }
   int e = errno;
   close(old_fd);
diff --git a/runtime/bin/file_fuchsia.cc b/runtime/bin/file_fuchsia.cc
index e1274393c0c..182b4a99772 100644
--- a/runtime/bin/file_fuchsia.cc
+++ b/runtime/bin/file_fuchsia.cc
@@ -412,7 +412,7 @@ bool File::Copy(Namespace* namespc,
   // TODO(ZX-429): Use sendfile/copyfile or equivalent when there is one.
   intptr_t result;
   const intptr_t kBufferSize = 8 * KB;
-  uint8_t buffer[kBufferSize];
+  uint8_t* buffer = reinterpret_cast<uint8_t*>(malloc(kBufferSize));
   while ((result = NO_RETRY_EXPECTED(read(old_fd, buffer, kBufferSize))) > 0) {
     int wrote = NO_RETRY_EXPECTED(write(new_fd, buffer, result));
     if (wrote != result) {
@@ -420,6 +420,7 @@ bool File::Copy(Namespace* namespc,
       break;
     }
   }
+  free(buffer);
   FDUtils::SaveErrorAndClose(old_fd);
   FDUtils::SaveErrorAndClose(new_fd);
   if (result < 0) {
diff --git a/runtime/bin/file_linux.cc b/runtime/bin/file_linux.cc
index dd8635309ad..bf51aba5cc7 100644
--- a/runtime/bin/file_linux.cc
+++ b/runtime/bin/file_linux.cc
@@ -419,7 +419,7 @@ bool File::Copy(Namespace* namespc,
   //   where sendfile() fails with EINVAL or ENOSYS.
   if ((result < 0) && ((errno == EINVAL) || (errno == ENOSYS))) {
     const intptr_t kBufferSize = 8 * KB;
-    uint8_t buffer[kBufferSize];
+    uint8_t* buffer = reinterpret_cast<uint8_t*>(malloc(kBufferSize));
     while ((result = TEMP_FAILURE_RETRY(read(old_fd, buffer, kBufferSize))) >
            0) {
       int wrote = TEMP_FAILURE_RETRY(write(new_fd, buffer, result));
@@ -428,6 +428,7 @@ bool File::Copy(Namespace* namespc,
         break;
       }
     }
+    free(buffer);
   }
   int e = errno;
   close(old_fd);
diff --git a/runtime/bin/gzip.cc b/runtime/bin/gzip.cc
index ebeb4082610..54945376de8 100644
--- a/runtime/bin/gzip.cc
+++ b/runtime/bin/gzip.cc
@@ -29,7 +29,7 @@ void Decompress(const uint8_t* input,
   }
   *output = reinterpret_cast<uint8_t*>(malloc(output_capacity));
 
-  uint8_t chunk_out[kChunkSize];
+  uint8_t* chunk_out = reinterpret_cast<uint8_t*>(malloc(kChunkSize));
   z_stream strm;
   strm.zalloc = Z_NULL;
   strm.zfree = Z_NULL;
@@ -80,6 +80,7 @@ void Decompress(const uint8_t* input,
   inflateEnd(&strm);
 
   *output_length = output_cursor;
+  free(chunk_out);
 }
 
 }  // namespace bin
diff --git a/runtime/vm/image_snapshot.cc b/runtime/vm/image_snapshot.cc
index 1fa49921984..30edc52f3ca 100644
--- a/runtime/vm/image_snapshot.cc
+++ b/runtime/vm/image_snapshot.cc
@@ -226,15 +226,16 @@ uint32_t ImageWriter::GetDataOffsetFor(RawObject* raw_object) {
 
 #if defined(DART_PRECOMPILER)
 void ImageWriter::DumpInstructionStats() {
-  CombinedCodeStatistics instruction_stats;
+  std::unique_ptr<CombinedCodeStatistics> instruction_stats(
+      new CombinedCodeStatistics());
   for (intptr_t i = 0; i < instructions_.length(); i++) {
     auto& data = instructions_[i];
     CodeStatistics* stats = data.insns_->stats();
     if (stats != nullptr) {
-      stats->AppendTo(&instruction_stats);
+      stats->AppendTo(instruction_stats.get());
     }
   }
-  instruction_stats.DumpStatistics();
+  instruction_stats->DumpStatistics();
 }
 
 void ImageWriter::DumpInstructionsSizes() {
diff --git a/runtime/vm/profiler_service.cc b/runtime/vm/profiler_service.cc
index c8b057aaab5..325e23c768f 100644
--- a/runtime/vm/profiler_service.cc
+++ b/runtime/vm/profiler_service.cc
@@ -992,6 +992,7 @@ class ProfileBuilder : public ValueObject {
         null_code_(Code::null()),
         null_function_(Function::ZoneHandle()),
         inclusive_tree_(false),
+        inlined_functions_cache_(new ProfileCodeInlinedFunctionsCache()),
         samples_(NULL),
         info_kind_(kNone) {
     ASSERT((sample_buffer_ == Profiler::sample_buffer()) ||
@@ -1205,9 +1206,9 @@ class ProfileBuilder : public ValueObject {
     Code& code = Code::ZoneHandle();
     if (profile_code->code().IsCode()) {
       code ^= profile_code->code().raw();
-      inlined_functions_cache_.Get(pc, code, sample, frame_index,
-                                   &inlined_functions, &inlined_token_positions,
-                                   &token_position);
+      inlined_functions_cache_->Get(pc, code, sample, frame_index,
+                                    &inlined_functions,
+                                    &inlined_token_positions, &token_position);
       if (FLAG_trace_profiler_verbose && (inlined_functions != NULL)) {
         for (intptr_t i = 0; i < inlined_functions->length(); i++) {
           const String& name =
@@ -1512,7 +1513,7 @@ class ProfileBuilder : public ValueObject {
   const AbstractCode null_code_;
   const Function& null_function_;
   bool inclusive_tree_;
-  ProfileCodeInlinedFunctionsCache inlined_functions_cache_;
+  ProfileCodeInlinedFunctionsCache* inlined_functions_cache_;
   ProcessedSampleBuffer* samples_;
   ProfileInfoKind info_kind_;
 };  // ProfileBuilder.
@@ -1735,7 +1736,7 @@ void Profile::PrintCodeFrameIndexJSON(JSONArray* stack,
 
 void Profile::PrintSamplesJSON(JSONObject* obj, bool code_samples) {
   JSONArray samples(obj, "samples");
-  ProfileCodeInlinedFunctionsCache cache;
+  auto* cache = new ProfileCodeInlinedFunctionsCache();
   for (intptr_t sample_index = 0; sample_index < samples_->length();
        sample_index++) {
     JSONObject sample_obj(&samples);
@@ -1765,7 +1766,7 @@ void Profile::PrintSamplesJSON(JSONObject* obj, bool code_samples) {
       for (intptr_t frame_index = 0; frame_index < sample->length();
            frame_index++) {
         ASSERT(sample->At(frame_index) != 0);
-        ProcessSampleFrameJSON(&stack, &cache, sample, frame_index);
+        ProcessSampleFrameJSON(&stack, cache, sample, frame_index);
       }
     }
     if (code_samples) {
diff --git a/runtime/vm/profiler_service.h b/runtime/vm/profiler_service.h
index 8460af83a9e..f34c24cae77 100644
--- a/runtime/vm/profiler_service.h
+++ b/runtime/vm/profiler_service.h
@@ -53,7 +53,7 @@ class ProfileFunctionSourcePosition {
   DISALLOW_ALLOCATION();
 };
 
-class ProfileCodeInlinedFunctionsCache : public ValueObject {
+class ProfileCodeInlinedFunctionsCache : public ZoneAllocated {
  public:
   ProfileCodeInlinedFunctionsCache() : cache_cursor_(0), last_hit_(0) {
     for (intptr_t i = 0; i < kCacheSize; i++) {
diff --git a/runtime/vm/unit_test.h b/runtime/vm/unit_test.h
index 0d134cdfb74..7dce8891580 100644
--- a/runtime/vm/unit_test.h
+++ b/runtime/vm/unit_test.h
@@ -467,7 +467,10 @@ struct is_double<double> {
 class AssemblerTest {
  public:
   AssemblerTest(const char* name, compiler::Assembler* assembler)
-      : name_(name), assembler_(assembler), code_(Code::ZoneHandle()) {
+      : name_(name),
+        assembler_(assembler),
+        code_(Code::ZoneHandle()),
+        disassembly_(Thread::Current()->zone()->Alloc<char>(DISASSEMBLY_SIZE)) {
     ASSERT(name != NULL);
     ASSERT(assembler != NULL);
   }
@@ -574,7 +577,7 @@ class AssemblerTest {
   compiler::Assembler* assembler_;
   Code& code_;
   static const intptr_t DISASSEMBLY_SIZE = 10240;
-  char disassembly_[DISASSEMBLY_SIZE];
+  char* disassembly_;
 
   DISALLOW_COPY_AND_ASSIGN(AssemblerTest);
 };